Airscanner Mobile Security Advisory #06070101:
Abidia & OAnywhere (All versions)

Product:
Abidia & OAnywhere

Platform:
Tested on Windows Mobile Pocket PC 2005

Requirements:
Mobile device running Windows Mobile Pocket PC with Abidia & OAnywhere

Credits:
Seth Fogie
Airscanner Mobile Security
http://www.airscanner.com
Mobile Antivirus Researchers Association
http://www.mobileav.org
02/03/2006

Risk Level:
Medium

Summary:
Abidia Wireless enhances the eBay and international eBay sites with effortless, anytime, anywhere, access via wireless handheld and mobile phone devices featuring customizable real-time synchronization with an eBay auction account, wireless searching, cached browsing, wireless bidding, and the ability to effortlessly manage auction listings on-the-go, anywhere you are, everywhere you need.
http://www.abidia.com/
Lack of user/pass protection for updates.

Details:
Update requests include authentication via a simple HTTP POST. The user/pass information for eBay is sent as plaintext. Use of this service exposes the account information and also provides a proxy for brute force password cracking.

POST /srvc/api.php?user=sethfogie&pass=mypass&serial=&imei=xxxx&site=US&name=sell HTTP/1.1
Host: api.abidia.com
User-Agent: Abidia-Wireless/3.0.2 (PocketPC; 480x640; WindowsMobile/5.1.70)
Accept: text/html
Content-Language: en-US
Connection: Close
Content-Length: 84
Content-type: application/x-www-form-urlencoded

user=sethfogie&pass=mypass&serial=&imei=xxxx&site=US

Workaround:
None

Vendor Response:
Awaiting Response

Copyright (c) 2006 Airscanner Corp.

Online advisory
http://www.airscanner.com/security/06070101_abidia_oanywhere.htm

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of Airscanner Corp. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please contact Airscanner Corp. for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use on an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.